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Quantum error-correcting codes are constructed that em- 
bed a finite-dimensional code space in the infinite-dimensional 
Hilbert space of a system described by continuous quantum 
variables. These codes exploit the noncommutative geometry 
of phase space to protect against errors that shift the values 
of the canonical variables q and p. In the setting of quantum 
optics, fault-tolerant universal quantum computation can be 
executed on the protected code subspace using linear opti- 
cal operations, squeezing, homodyne detection, and photon 
counting; however, nonlinear mode coupling is required for 
the preparation of the encoded states. Finite-dimensional 
versions of these codes can be constructed that protect en- 
coded quantum information against shifts in the amplitude 
or phase of a d-state system. Continuous-variable codes can 
be invoked to establish lower bounds on the quantum capacity 
of Gaussian quantum channels. 



I. INTRODUCTION 

Classical information can be carried by either a dis- 
crete (digital) signal or a continuous (analog) signal. Al- 
though in principle an analog signal can be processed, 
digital computing is far more robust - a digital signal 
can be readily re-standardized and protected from dam- 
age caused by the gradual accumulation of small errors. 

Quantum information can also be carried by either 
a discrete (finite-dimensional) system like a two-level 
atom or an electron spin, or by a continuous (infinite- 
dimensional) system like a harmonic oscillator or a rotor. 
Even in the finite-dimensional case, quantum information 
is in a certain sense continuous - a state is a vector in 
a Hilbert space that can point in any direction. Never- 
theless, we have known for nearly five years that cleverly 
encoded quantum states can be re-standardized and pro- 
tected from the gradual accumulation of small errors, or 
from the destructive effects of decoherence due to uncon- 
trolled interactions with the environment . 

One is tempted to wonder whether we can go still fur- 
ther and protect the quantum state of a system described 
by continuous quantum variables. Probably this is too 
much to hope for, since even the problem of protecting 



analog classical information seems to pose insuperable 
difficulties. 

In this paper we achieve a more modest goal: we 
describe quantum error-correcting codes that protect a 
state of a finite- dimensional quantum system (or "qu- 
dit") that is encoded in an infinite-dimensional system. 
These codes may be useful for implementing quantum 
computation and quantum communication protocols that 
use harmonic oscillators or rotors that are experimentally 
accessible. 

We also explain how encoded quantum states can be 
processed fault tolerantly. Once encoded states have 
been prepared, a universal set of fault-tolerant quan- 
tum gates can be implemented using, in the language 
of quantum optics, linear optical operations, squeezing, 
homodyne detection, and photon counting. However, for 
preparation of the encoded states, nonlinear couplings 
must be invoked. 

Our continuous-variable quantum error-correcting 
codes are effective in protecting against sufficiently weak 
diffusive phenomena that cause the position and momen- 
tum of an oscillator to drift, or against losses that cause 
the amplitude of an oscillator to decay. By concatenat- 
ing with conventional finite-dimensional quantum codes, 
we can also provide protection against errors that heavily 
damage a (sufficiently small) subset of all the oscillators 
in a code block. 

A different scheme for realizing robust and efficient 
quantum computation based on linear optics has been 
recently proposed by Knill, Laflamme, and Milburn [^,||. 

We begin in §^ by describing codes that embed an 
n-state quantum system in a larger d-state system, and 
that protect the encoded quantum information against 
shifts in the amplitude or phase of the d-state system. 
A realization of this coding scheme based on a charged 
particle in a magnetic field is discussed in 
continuous-variable codes are obtained in 
sidering a d ^ oo limit. Formally, the code states of 
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the continuous- variable codes are nonnormalizable states, 
infinitely squeezed in both position and momentum; in 
j |v| we describe the consequences of using more realis- 
tic approximate code states that are finitely squeezed. 
In §^ we outline the theory of more general continuous- 
variable codes based on lattice sphere packings in higher- 
dimensional phas e sp ace. 

We discuss in § VII how continuous- variable codes pro- 



tect against quantum diffusion, amplitude damping, and 
unitary errors. In §VIII, we establish a lower bound on 



the quantum capacity of the Gaussian quantum channel. 
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We then proceed to develop schemes for fauh-tolerant 
manipulation of encoded quantum information, starting 
in with a discussion of the symplectic operations that 
can be implemented with linear optics and squeezing. In 
^ we discuss the measurement of the error syndrome 
and error recovery, which can be achieved with symplec- 
tic operations and homodyne detection. Completion of 
the fault-tolerant universal gate set by means of photon 
counting is described in § XI, and the preparation of en- 



coded states is explained in §XII 



Finally, § XIIl contains some further remarks about the 



physical realization of our coding schemes, and §XIV con- 
tains concluding comments. 



II. SHIFT-RESISTANT QUANTUM CODES 

The main novelty of our new codes is that they are 
designed to protect against a different type of error than 
has been considered in previous discussions of quantum 
coding. This distinction is more easily explained if we 
first consider not the case of a continuous quantum vari- 
able, but instead the (also interesting) case of a "qudit," 
a d-dimensional quantum system. Quantum codes can 
be constructed that encode k protected qudits in a block 
of N qudits, so that the encoded qudits can be perfectly 
recovered if up to t qudits are damaged, irrespective of 
the nature of the damage (|-|^. Error recovery will be 
effective if errors that act on many qudits at once are 
rare. More precisely, a general error superoperator act- 
ing on N qudits can be expanded in terms of a basis of 
operators, each of definite "weight" (the number of qu- 
dits on which the operator acts nontrivially) . Encoded 
information is well protected if the error superoperator 
has nearly all its support on operators of weight t or less. 

But consider instead a different situation, in which the 
amplitude for an error to occur on each qudit is not small, 
but the errors are of a restricted type. The possible errors 
acting on a single qudit can be expanded in terms of 
a unitary operator basis with cP elements, the "Pauli 
operators" : 



X^'Z^ a,6 = 0, l,2,...,rf- 1 



(1) 



Here X and Z are generalizations of the Pauli matri- 
ces ax and (Tz, which act in a particular basis {\j),j = 
0,1,2, ... ,d — 1} according to 



X : \j) ^ |j + 1 (mod d)) 
Z:\j)^u;=\j) , 



(2) 



where uj = exp(27ri/c?). Note that it follows that 

ZX = ujXZ. (3) 

For N qudits, there is a unitary operator basis with c?^^ 
elements consisting of all tensor products of single-qudit 
Pauli operators. 



We will now imagine that errors with \a\, \b\ small com- 
pared to d are common, but errors with large \a\ and |6| 
are rare. This type of error model could be expected 
to apply in the case of a continuous quantum variable, 
which is formally the d — *■ oo limit of a qudit. For exam- 
ple, decoherence causes the position q and momentum p 
of a particle to diffuse with some nonzero diffusion con- 
stant. In any finite time interval q and p will drift by 
some amount that may be small, but is certainly not 
zero. How can we protect encoded quantum information 
under these conditions? 

Fortunately, the general "stabilizer" framework PjTc|] 
for constructing quantum codes can be adapted to this 
setting. In this framework, one divides the elements of 
a unitary operator basis into two disjoint and exhaustive 
classes: the set £ of "likely errors" that we want to pro- 
tect against, and the rest, the "unlikely errors." A code 
subspace is constructed as the simultaneous eigenspace of 
a set of commuting "stabilizer generators," that generate 
an Abelian group, the "code stabilizer." The code can 
reverse errors in the set £ if, for each pair of errors Ea and 
El,, either E^E}, lies in the stabilizer group, or ElEb fails 
to commute with some element of the stabilizer. (In the 
latter case, the two errors alter the eigenvalues of the gen- 
erators in distinguishable ways; in the former case they 
do not, but we can successfully recover from an error of 
type a by applying either E^ or eI.) In typical discus- 
sions of quantum coding, £ is assumed to be the set of 
all tensor products of Pauli operators with weight up to t 
(those that act trivially on all but at most t qudits). But 
the same principles can be invoked to design codes that 
protect against errors in a set £ with other properties. 

Quantum codes for continuous variables have been de- 
scribed previously by Braunstein [p| and by Lloyd and 
Slotine [r2j. For example, one code they constructed can 
be regarded as the continuous limit of a qudit code of the 
type originally introduced by Shor in the binary (d = 2) 
case, an [[N — 9, k — l,2t + 1 = 3]] code that protects 
a single qudit encoded in a block of 9 from arbitrary 
damage infiictcd on any one of the 9. The 8 stabilizer 
generators of the code can be expressed as 

Z1Z2 ^ , ^2-^3 ^ , Z^Z^ ^ , Z^Zq ^ , ZrZg ^ , ZsZg ^ , 
{X1X2X3) ■ (XiX^Xe)-' , {XiX^Xe) ■ (XjXsX^)-^ , (4) 

and encoded operations that commute with the stabilizer 
and hence act on the encoded qudit can be chosen to be 



Z — Zi Z4. Z^ , 
X = X\X2Xy, 



(5) 



In the d — > 00 limit, we obtain a code that is the simul- 
taneous eigenspace of eight commuting operators acting 
on nine particles, which are 

91-92 ,92-93 ,94-95 ,95 - 96 , 97 - 98, 98 - 99 , 
(pi + P2 + Pa) - (P4 + P5 + Pe) , 

(P4 +P5 +P6) - (PT +P8 +P9) • (6) 
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Logical operators that act in the code space are 



9 = 91 + 94 + 97 

P1+P2+P3 



(7) 



This code is designed to protect against errors in which 
one of the particles makes a large jump in q or p (or both) 
while the others hold still. But it provides little protec- 
tion against small diffusive motions of all the particles, 
which allow q and p to drift. 

Entanglement purification protocols for continuous 
variable systems have also been proposed — good entan- 
gled states can be distilled from noisy entangled states 
via a protocol that requires two-way classical commu- 
nication 14|. These purification protocols work well 
against certain sorts of errors, but their reliance on two- 
way classical communication makes them inadequate for 
accurately preserving unknown states in an imperfect 
quantum memory, or for robust quantum computation. 

Returning to qudits, let us consider an example of a 
quantum code that can protect against small shifts in 
both amplitude and phase, but not against large shifts. 
It is already interesting to discuss the case of a system 
consisting of a single qudit, but where the dimension n 
of the encoded system is (of course) less than d. For 
example, a qubit {n = 2) can be encoded in a system 
with dimension d — 18, and protected against shifts by 
one unit in the amplitude or phase of the qudit; that is, 
against errors of the form X'^Z^ where \a\, \b\ < 1. The 
stabilizer of this code is generated by the two operators 



(8) 



and the commutation relations of the Pauli operators 
with these generators are 



(X'^Z'') ■ X^ 
{X'^Z'') ■ z^ 



: u;'" X' 



[X'^Z'' 
Z^ ■ {X'^Z'' 



(9) 



Therefore, a Pauli operator commutes with the stabilizer 
only if a and b are both multiples of 3 = 18/6; this prop- 
erty ensures that the code can correct single shifts in 
both amplitude and phase. Logical operators acting on 
the encoded qudit are 



X = x-' 



Z ^ Z^ 



(10) 



which evidently commute with the stabilizer and are not 
contained in it. 

Since the codewords are eigenstates of Z^ with eigen- 
value one, the only allowed values of j are multiples of 
three. And since there are also eigenstates of X^ with 
eigenvalue one, the codewords are invariant under a shift 
in j by six units. A basis for the two-dimensional code 
space is 



|0) = i=(|0) + |6) + |12)) 
|T) = -i=(|3) + |9) + |15)) 



(11) 



If an amplitude error occurs that shifts j by ±1, the 
error can be diagnosed by measuring the stabilizer gen- 
erator Z^, which reveals the value of j modulo 3; the 
error is corrected by adjusting j to the nearest multiple 
of 3. Phase errors are shifts in the Fourier transformed 
conjugate basis, and can be corrected similarly. 

This code is actually perfect, meaning that each possi- 
ble pair of eigenvalues of the generators X^ and Z^ is a 
valid syndrome for correcting a shift. There are nine pos- 
sible errors {X°-Z^, |a|,|6| < 1}, and the Hilbert space 
of the qudit contains nine copies of the two-dimensional 
code space, one corresponding to each possible error. 
These "error spaces" just barely fit in the qudit space 
for d 18 = 9 • 2. 

Similar perfect codes can be constructed that protect 
against larger shifts. For d = rir2n, consider the stabi- 
lizer generators 

There is an encoded qunit, acted on by logical operators 

X = X''^ , 

Z = Z^^ , (13) 

which evidently commute with the stabilizer and satisfy 

ZX = u/^''^XZ ^e^^'^l'^XZ . (14) 

The commutation relations of the Pauli operators with 
the generators are 

= e-2^'°Ai Z'^^n . i^x'^Z^) . (15) 



The phases are trivial only if a is an integer multiple of 
r\ and h an integer multiple of r2. Therefore, this code 
can correct all shifts with 



(16) 



The number of possible error syndromes is r\r2 — d/n, 
so the code is perfect. 

Expressed in terms of Z eigenstates, the codewords 
contain only values of j that are multiples of ri (since 
^r-2n _ Q^^^ QTj-Q invariant under a shift of j by rin 
(since X''^" — 1). Hence a basis for the n-dimcnsional 
code subspace is 

|0) = ^ (|0) + |nri) + . . . + |(r2 - l)nr{)) , 
(|ri) + ... + |((r2-l)n+l)ri)) , 



1> = 



(|(n-l)ri) + ...-f |(r2n-l)ri)) . (17) 
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If the states undergo an amplitude shift, the value of j 
modulo ri is determined by measuring the stabilizer gen- 
erator Z''^", and the shift can be corrected by adjusting j 
to the nearest multiple of ri . The codewords have a sim- 
ilar form in the Fourier transformed conjugate basis (the 
basis of X eigenstates), but with ri and r2 interchanged. 
Therefore, amplitude shifts by less than ri/2 and phase 
shifts by less than r2/2 can be corrected. 

III. A QUDIT IN A LANDAU LEVEL 

A single electron in a uniform magnetic field in two 
dimensions provides an enlightening realization of our 
codes. General translations in a magnetic field are 
noncommuting, since an electron transported around 
a closed path acquires an Aharonov-Bohm phase e'*^*, 
where $ is the magnetic flux enclosed by the path. 
Two translations T and S commute only if the opera- 
tor TST^^S^^ translates an electron around a path that 
encloses a flux $ — fc$o, where $0 = 27r/e is the flux 
quantum and k is an integer. 

Translations commute with the Hamiltonian H, and 
two translations Ti and T2 form a maximally commuting 
set if they generate a lattice that has a unit cell enclosing 
one quantum of flux. Simultaneously diagonalizing _ff , Ti 
and T2, we obtain a Landau level of degenerate energy 
eigenstates, one state corresponding to each quantum of 
magnetic flux. Then Ti and are the stabilizer gen- 
erators of a code, where Z = T^^^ and X = T2 are the 
logical operators on a code space of dimension n. 

Suppose the system is in a periodically identified box 
(a torus), so that = (Tj")''^ = 1 are translations 
around the cycles of the torus. The number of flux quanta 
through the torus, and hence the degeneracy of the Lan- 
dau level, is nr 1X2- The code, then, embeds an n dimen- 
sional system in a system of dimension d — rir2n. 

In this situation, the logical operations X and Z can 
be visualized as translations of the torus in two different 
directions; the stabilizer generator X" is a translation by 
a fraction l/r2 of the length of the torus in one direction, 
and the stabilizer generator Z" is a translation by 1/ri 
of the length in the other direction. Therefore, for any 
state in the code space, the wave function of the electron 
in a cell containing n flux quanta is periodically repeated 
altogether rir2 times to fill the entire torus. Our code 
can be regarded as a novel kind of "quantum repetition 
code" - identical "copies" of the wave function are stored 
in each of rir2 cells. But of course there is only one 
electron, so if we detect the electron in one cell its state 
is destroyed in all the cells. 

This picture of the state encoded in a Landau level cau- 
tions us about the restrictions on the type of error model 
that the code can fend off successfully. If the environ- 
ment strongly probes one of the cells and detects noth- 
ing, the wave function is suppressed in that cell. This 
causes a X error in the encoded state with a probabil- 



ity of about l/2r2, and a Z error with a probability of 
about l/2ri. The code is more effective if the typical 
errors gently deform the state in each cell, rather than 
strongly deforming it in one cell. 



IV. CONTINUOUS VARIABLE CODES FOR A 
SINGLE OSCILLATOR 

Formally, we can construct quantum codes for systems 
described by continuous quantum variables by consider- 
ing the large-d limit of the shift-resistant codes described 
in We might have hoped to increase d to infinity 
while holding ri/d and r2/d fixed, maintaining the abil- 
ity to correct shifts in both amplitude and phase that are 
a fixed fraction of the ranges of the qudit. However, since 
the perfect codes satisfy 

a nr2 d nri 

this is not possible. Nonetheless, interesting codes can 
be obtained as the amplitude and phase of the qudit ap- 
proach the position q and momentum p of a particle - we 
can hold fixed the size of the shifts Aq and Ap that can 
be corrected, as the ranges of q andp become unbounded. 

Another option is to take d ^ 00 with ri/d= ^ fixed 
and r2 = m/n fixed, obtaining a rotor Z = e'^ (or a 
particle in a periodically identified finite box) that can 
be protected against finite shifts in both the orientation 
6 of the rotor and its (quantized) angular momentum L. 
The stabilizer of this code is generated by 

and the logical operations are 

X = e-2"i/"' (20) 

Since X shifts the value of by 211 jm^ and Z shifts the 
value of L by m/n = r2, this code can correct shifts in d 
with AQ < Ti/m and shifts in L with |AL| < m/2n. 

Alternatively, we can consider a limit in which ri and 
r2 both become large. Wc may write ri = a/e and r2 — 
1/nae, where d — nrir2 — obtaining a code with 

stabilizer generators 

j^rin ^ ipe j (^^^Z*^) ^ — inpa (21) 

and logical operations 

Z = e^''*'/"" , X = e-*P" , (22) 

where a is an arbitrary real number. Using the identity 
c^e^ — e^^'-^^e-^e^ (which holds if A and B commute 
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with their commutator) and the canonical commutation 
relation [q,p\ = i, we verify that 



ZX = LuXZ . Lu ~ e 



27Ti/n 



(23) 



Since X translates g by a and Z translates p by 2ti /na, 
the code protects against shifts with 



|Ag|< 



|Ap| < — . 
na 



(24) 



Note that the shifts in momentum and position that the 
code can correct obey the condition 



2n 



(25) 



In typical situations, errors in q and p are of comparable 
magnitude, and it is best to choose a = ^I-k jn so that 




Formally, the codewords are coherent superpositions of 
infinitely squeezed states, e.g. (up to normalization) 



\Z^uj'^)= ^ Ig = a(j + ns)) , 



27r 



{i + ns)) 



(27) 



S — — CQ 



(See Fig. I.) Of course, realistic codewords will be nor- 
malizable finitely squeezed states, rather than nonnor- 
malizable infinitely squeezed states. But squeezing in at 
least one of p and q is required to comfortably fulfill the 
condition eq. (pF 
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FIG. 1. Codewords of the n = 2 code. The states |0), |1) 
are superpositions of q eigenstates, periodically spaced with 
period 2a\ the two basis states differ by a displacement in 
q by a. The states (|0) ± |l))/-\/2 are superpositions of p 
eigenstates, periodically spaced with period 2Ti/a; the two 
basis states differ by a displacement in p by vr/a. 



The Wigner function associated with the codeword 
wave function tp'^^^q) = {q\Z = lo-') is a sum of delta 
functions positioned at the sites of a lattice in phase 
space, where three quarters of the delta functions are 
positive and one quarter are negative. Explicitly, we have 

VF(^)(g,p) = — / dx e'P'-'ip^^'>{q + x/2)*iP^^'){q-x/2) 
2n 



X 6 [q- aj - — - t] ; 



(28) 



the delta functions are negative on the sublattice with 
s, t odd. If we integrate over p, the oscillating sign causes 
the terms with odd t to cancel in the sum over s, and the 
surviving positive delta functions have support at q = 
(n • integer + j)a. If we integrate over q, the terms with 
odd s cancel in the sum over i, and the surviving positive 
delta functions have support at p — {2-K/na) ■ integer. 
Wigner functions for the X eigenstates are similar, but 
with the roles of q and p interchanged. 

It is also of interest to express the encoded states in 
terms of the basis of coherent states. Consider for exam- 
ple the encoded state with X — 1^ which is the unique 
simultaneous eigenstate with eigenvalue one of the oper- 
ators e^'^^'il'^ and e"'^". In fact starting with any state 
IV'), we can construct the encoded state (up to normal- 
ization) as 



(EI 



^ exp [i {—spa + 27Ttq/a + nst)] 



(29) 



In particular, if we choose 1-0) to be the ground state 
|0) of the oscillator, then the opera- 
tor J exp [i (— spa + 27ri(7/a + TTst)] displaces it to a 
coherent state centered at the point {q,p) = (sa, 27rt/a) 
in the quadrature plane. Thus the encoded state is an 
equally weighted superposition of coherent states, with 
centers chosen from the sites of a lattice in the quadra- 
ture plane whose unit cell has area 27r. Since the coherent 
states are overcomplete the expansion is not unique; in- 
deed, if we choose |'0) to be a coherent state rather than 
the vacuum, then the lattice is rigidly translated, but the 
encoded state remains invariant. 

We can envision the stabilizer of the code as a lat- 
tice of translations in phase space that preserve the code 
words, the lattice generated by the translations e^'^^tl'^ 



and 



In fact, this lattice need not be rectangular 



- we can encode an rt-dimensional system in the Hilbert 
space of a single oscillator by choosing any two variables 
Q and P that satisfy the canonical commutation relation 
[Q, P] — i, and constructing the code space as the simul- 
taneous eigenstate of e^'^*'^ a^^i e~™^. The unit cell of 
the lattice has area 27r?in, in keeping with the principle 
that each quantum state "occupies" an area 27r?i in the 
phase space of a system with one continuous degree of 
freedom. 
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V. FINITE SQUEEZING 

Strictly speaking, our codewords are nonnormalizable 
states, infinitely squeezed in both q and p. In practice, 
we will have to work with approximate codewords that 
will be finitely squeezed normalizable states. We need 
to consider how using such approximate codewords will 
affect the probability of error. 

We will replace a position eigenstate <5(0) by a normal- 
ized Gaussian of width A centered at the origin, 



dq 



, (7rA2)i/4 
dp 

_^ (7r/A2)i/4 



e 2' 



(30) 



A codeword, formally a coherent superposition of an infi- 
nite number of (5-functions, becomes a sum of Gaussians 
weighted by a Gaussian envelope function of width k~^; 
in the special case of a two-dimensional code space, the 
approximate codewords become 

oo 

|0) ^No J2 e-^-^(2-)V(2sa)|^o) , 

S — — OQ 
OO 

\i)=Ni J2 e-5'''[('^+i)")lV[(2s+l)a]|V'o) , (31) 

s— — oo 

where T(a) translates q by a, A'o,! are normalization fac- 
tors, and we use e.g. |0) rather than |0) to denote the 
approximate codeword. We will assume that na and 
A/a are small compared to one, so that Nq Ki Ni Ki 
(^K^a^ /ttY^'^; then in momentum space, the approximate 
codeword becomes e.g., 



(|o) + |i))/V2 



dp 



LAV 



OO 
S — — OO 

By applying the Poisson summation formula, 

oo oo 



2-Kish 



(32) 



(33) 



this approximate codeword can be rewritten as 

dp 



(|0) 



|1»/V2 
\/2^ 



2 2\ 1/4 



X ■ 



m— — oo 

dp 



X exp 



(7r/«2)i/4 \^ a 



(VA2)l/4 

I ( 2^ V / 2 
/47rA2\^/^ ^ _: 



\v) 



\v) , 



(34) 



again a superposition of Gaussians weighted by a Gaus- 
sian envelope. (See Fig. |[) 

Probability 




FIG. 2. Probability distribution in position space 
-^(9) = ^K'zKIO) + for approximate codeword with 

A = K = .25. The dashed line is the distribution's Gaussian 
envelope. 

The approximate codewords |0), |1) have a small over- 
lap if A is small compared to a and k is small compared 
to 7r/a. For estimating the error probability caused by 
the overlap, let's consider the special case where q and p 
are treated symmetrically, a = ^JH and k = A; then 



s— — 00 



(35) 



and 



^|(p|6) + (p|i>r 



A= J2 e-^'f'exp[-(p-2mx^F)VA2 



(36) 



To perform error recovery, we measure the value of q and 
p modulo and then correct for the observed shift. In 
the state |0), the probability of failure is the probabil- 
ity that q is closer to an odd multiple of ^/^T than an 
even multiple, and in the state (|0) -I- |i))/-\/2, the error 
probability is the probability that p is closer to an odd 
multiple of than an even multiple. For both the am- 
plitude and phase errors, the intrinsic error probability 
arising from the imperfections of the approximate code- 
words becomes exponentially small for small A. Using 
the asymptotic expansion of the error function. 



dt e"* 



(^) e-^' (1 - 0(l/x^)) , (37) 



we may estimate the error probability by summing the 
contributions from the tails of all the Gaussians, obtain- 
ing 
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Error Prob < —= ( ^ 




2A 



(38) 



This error probability is about 1% for A ^ .5, and is 
already less than 10~^ for a still modest value A ^ .25. 
Using finitely squeezed approximate codewords does not 
badly compromise the error-correcting power of the code, 
since a gentle spreading in -p and q is just the kind of error 
the code is intended to cope with. 

The mean photon number of a finitely squeezed ap- 
proximate codeword is 



(ata) + l/2= -(p2+g2 



A" 



(39) 



for small A. Therefore, an error probability of order 10^^ 
can be achieved with Gaussian approximate codewords 
that have mean photon number of about (.25) ~ 16. 

More generally, a finitely squeezed codeword can 
be regarded as a perfect codeword |^) that has undergone 
an error; we may write 



(40) 



where 77(1*, v) is an error "wave function." In the special 
case of a Gaussian finitely squeezed codeword, we have 

i^M = ^l=exp(-i(«VA2 + 7;V«^)) , (41) 

where A and k are the squeezing parameters defined 
above. 

If r]{u,v) vanishes for |u| > a/2 or \v\ > 7r/(na), then 
the error is correctable. In this case, the interpreta- 
tion of ri{u, v) as a wave function has a precise mean- 
ing, since there is an unambiguous decomposition of a 
state into codeword and error. Indeed, if 1^2) are 
perfect codewords and \ip2) are the corresponding 

finitely squeezed codewords with error wave functions 771 , 
7/2, then 



where 



(V'l|V^2) = (Cl|6)(ml^2) 



(??i|??2) = / dudv r]i{u,vy ri2{u,v) 



(42) 



(43) 



VI. CONTINUOUS VARIABLE CODES FOR 
MANY OSCILLATORS 



The continuous variable codes described in SLY 



based on simple lattices in the two-dimensional phase 



space of a single particle. We can construct more sophis- 
ticated codes from lattices in the (2iV)-dimensional phase 
space of N particles. Then codes of higher quality can 
be constructed that take advantage of efficient packings 
of spheres in higher dimensions. 

For a system of N oscillators, a tensor product of Pauli 
operators can be expressed in terms of the canonical vari- 
ables qi and pi as 



Uai3 = exp 



JV 



\i=l 



(44) 



where the a^'s and /3i's are real numbers. (In this setting, 
the Pauli operators are sometimes called "Weyl opera- 
tors.") Two such operators commute up to a phase: 



where 



Lu{af3,a'/3') = a ■ (3' 



■a 



(45) 



(46) 



is the symplectic form. Thus two Pauli operators com- 
mute if and only if their symplectic form is an integer. 

Now a general continuous variable stabilizer code is the 
simultaneous eigenspace of commuting Pauli operators, 
the code's stabilizer generators. If the continuous vari- 
able phase space is 2A^-dimensional and the code space 
is a finite-dimensional Hilbert space, then there must be 
2N independent generators. The elements of the sta- 
bilizer group are in one-to-one correspondence with the 
points of a lattice C in phase space, via the relation 



[/(fci,/c2, . . .k2N) = exp 




(47) 



Here {wq, a — 1,2,..., 2A^} are the basis vectors of the 
lattice (each a linear combination of g's and p's), the 
fca's are arbitrary integers, and J7(fci, ^2, • ■ • few) is the 
corresponding element of the stabilizer. For the stabi- 
lizer group to be Abelian, the symplectic inner product 
of any pair of basis vectors must be an integer; that is, 
the antisymmetric 2N x 2N matrix 



Aab = Uj{Va,Vb) 



(48) 



has integral entries. The lattice C has a 2N x 2N gener- 
ator matrix M whose rows are the basis vectors, 



V2 



M 



(49) 



\V2N / 

In terms of M, the matrix A can be expressed as 

A = McjM^ , (50) 
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where uj denotes the 2iV x 2iV matrix 



or 



/ 

-/ 



(51) 



and / is the N x N identity matrix. 

The generator matrix of a lattice is not unique. The 
replacement 



M M' = RM 



(52) 



leaves the lattice unmodified, where R is an invertible in- 
tegral matrix with determinant ±1 (whose inverse is also 
integral). Under this replacement, the matrix A changes 
according to 



A^A' = RAR^ 



(53) 



By Gaussian elimination, an R can be constructed such 
that the antisymmetric matrix A is transformed to 



A' = 



D 

-D 



(54) 



where _D is a positive diagonal N x N matrix. 

There are also Pauli operators that provide a basis for 
the operations acting on the code subspace - these are 
the Pauli operators that commute with the stabilizer but 
are not contained in the stabilizer. The operators that 
commute with the stabilizer themselves form a lattice 
C-^ that is dual (in the symplectic form) to the stabilizer 
lattice. The basis vectors of this lattice can be chosen to 
be {ub, 6=1,2,3,..., 2iV} such that 



LL>{Ua,Vb) = Sab 



(55) 



then the generator matrix 



of has the property 



U2 



\U2N / 



(57) 



It follows from eq. (|4^) and eq. (|55| ) that the C basis 
vectors can be expanded in terms of the basis vectors 

as 



or 



and hence that 



= ^ AabUb , 



M = AM^ 



Uj{Ua,Ub) = (A) J 



(58) 

(59) 
(60) 



M^co{M^y ={A-Y . (61) 

If the lattice basis vectors are chosen so that A has the 
standard form eq. (^, then 



D-^ 
-D-^ 



(62) 



In the special case of a self-dual lattice, corresponding to 
a code with a one-dimensional code space, both A and 
A~^ must be integral; hence D = and the standard 
form of A is 



(63) 



Since the code subspace is invariant under the trans- 
lations in £, we can think of the encoded information 
as residing on a torus, the unit cell of C. The encoded 
Pauh operators {X"-Z''} are a lattice of translations on 
this torus, corresponding to the coset space £^/C. The 
number of encoded Pauli operators is the ratio of the vol- 
ume of the unit cell of C to the volume of the unit cell of 
, namely the determinant of A, which is therefore the 
square of the dimension of the Hilbert space of the code. 
Thus the dimension of the code space is 



|Pf A\ = det D 



(64) 



where Pf A denotes the Pfaffian, the square root of the 
determinant of the antisymmetric matrix A. 

The stabilizer lattice unit cell has volume |Pf A\ in 
units with h — 2-Kfi — 1, and the unit cell of the lattice of 
encoded operations has volume |Pf A\~^ in these units. 
So the code fits an n-dimensional code space into n units 
of phase space volume, as expected. 

Codes of the CSS type (those analogous to the binary 

f,ntum codes first constructed by Calderbank and Shor 
and by Steane |l^) are constructed by choosing one 
lattice Cq describing stabilizer generators that are linear 

(56) 

combinations of the g's, and another lattice Cp C Cj: 
describing stabilizer generators that are linear combina- 
tions of the p's. (Here Cj^ denotes the Euclidean dual of 
the lattice Cq.) The generator matrix of a CSS code has 
the form 



M 



Mq 
Mr 



(65) 



where Mq and Mp are N x N matrices, and the integral 
matrix A has the form 



A = 





-MpM^ 



MqM^ 





(66) 



For single-oscillator codes described in §IV, A is the 
2x2 matrix 



A 



n 
~n 



(67) 



where n is the code's dimension. For a single-oscillator 
CSS code, the lattice is rectangular, as shown in Fig. ||. 
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[[7, 1,3]] block code to protect one logical qubit against 
severe damage to any one of the oscillators. 

For n > 5, there is a [[5,1,3]] polynomial code [ pT| , 
also well suited to fault-tolerant processing, encoding one 
qunit in a block of 5. (Actually, [[5, 1,3]] quantum codes 
exist for n < 5 as well [^|0] , but these codes are less con- 
ducive to fault-tolerant computing.) The larger value of 
n increases the vulnerability of each qunit to shift errors. 
Hence, whether the [[7,1,3]] binary code or the [[5,1,3]] 
should be preferred depends on the relationship of the 
size of the typical shift errors to the rate of large errors. 



VII. ERROR MODELS 



FIG. 3. The stabilizer lattice and its dual for ann — 2 code 
of a single oscillator. Solid lines indicate the stabilizer lattice; 
solid and dotted lines together comprise the dual lattice. In 
units of {2tvTi)^ , the unit cell of the stabilizer lattice (shaded) 
has area 2, and the unit cell of its dual has area 1/2. 

The closest packing of circles in two dimensions is 
achieved by the hexagonal lattice. The generator ma- 
trix for a hexagonally encoded qunit can be chosen to 
be 



M = 



2 

V3 



1/2 



1 

1/2 





V3/2 



and the dual lattice is generated by 



i.M 

n 



(68) 



(69) 



The shortest vector of the dual lattice has length 

1 /2 

(2/n^/3i) , compared to length for the square 

lattice. Therefore the size of the smallest uncorrectable 
shift is larger for the hexagonal code than for the square 

lattice code, by the factor (2/^3)^^^ « 1.07457. 

An important special class of quantum codes for many 
oscillators are the concatenated codes. In particular, we 
can encode a qubit in each of N oscillators using the 
code of §IV. Then we can use a binary stabilizer code 



that encodes k qubits in a block of TV oscillators, and pro- 
tects against arbitrary errors on any t oscillators, where 
2t + 1 is the binary code's distance. The concatenated 
codes have the important advantage that they can pro- 
tect against a broader class of errors than small diffusive 
shifts applied to each oscillator - if most of the oscillators 
undergo only small shifts in p and q, but a few oscillators 
sustain more extensive damage, then concatenated codes 
still work effectively. 

For example, there is a binary [[7, 1,3]] quantum code, 
well suited to fault-tolerant processing, that encodes one 
logical qubit in a block of seven qubits and can pro- 
tect against heavy damage on any one of the seven [^ . 
Given seven oscillators, we can encode a qubit in each one 
that is resistant to quantum diffusion, and then use the 



What sort of errors can be corrected by these codes? 
The codes are designed to protect against errors that shift 
the values of the canonical variables p and q. In fact the 
Pauli operators are a complete basis, so the action of 
a general superoperator £ acting on the input density 
matrix p of a single oscillator can be expanded in terms 
of such shifts, as in 



£{p) ^ / dadf3da'dp' C{a, l3; a' f3' 



X g*("P+/3<?) p g-i(a'p+/3'9) 



(70) 



If the support of C(a, /3; a', /?') is concentrated on suffi- 
ciently small values of its arguments, then the input p 
can be recovered with high fidelity. 

A useful model of decoherence is the special case of a 
"Pauli channel" in which C{a, /3;a' , (3') is diagonal and 
the superoperator can be expressed as 

£{p) ^ f dadp P(a,/3) e'("P+''«) p e-'("P+'3«) . (71) 



Since £ is positive and trace preserving, we infer that 
P{a, /?) > and 



dadp P{a,l3) = 1 . 



(72) 



Thus, we may interpret P{oi, (3) as a probability distri- 
bution: the phase space translation 



(9,P) ^ (g - a,p + (3) 



(73) 



is applied with probability P{a, (3). 

Weak interactions between an oscillator and its envi- 
ronment drive a diffusive process that can be well mod- 
eled by a Pauli channel. If the environment quickly "for- 
gets" what it learns about the oscillator, the evolution 
of the oscillator can be described by a master equation. 
Over a short time interval dt, the shifts applied to the 
oscillator may be assumed to be small, so that the Pauli 
operator can be expanded in powers of a and (3. Suppose 
that the shifts are symmetrically distributed in phase 
space such that 
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(a 



(/3)=0 
(a/3) = , 



(74) 



where (•) denotes the mean value determined by the prob- 
ability distribution P{a,(3). Suppose further that the 
shifts are diffusive, so that the mean square displacement 
increases linearly with dt; we may write 

(a^) ^ (/32) ^ j^dt , (75) 
where D is a diffusion constant. We then obtain 
p{t + dt) = J dadf3 P{a,P) e^(«f+^«V e-*("f+^«) 



= p{t) + Ddt ( ppp - ^p^p 



+ Ddt ( qpq - ^q^p - ^pq^ ] + 0{dt"^) , (76) 



or 



(77) 



The interpretation of £) as a diffusion constant can be 
confirmed by computing 



|tr (pV) =D = j^tr {q-p) ■ 



(78) 



the mean square values of p and q increase with time as 
Dt. 

More generally, the master equation contains a diffu- 
sive term determined by the covariance of the distribu- 
tion P(a,(3), and perhaps also a nondissipative drift term 
determined by the mean of P{a, [3). Our quantum error- 
correcting codes can successfully suppress decoherence 
caused by quantum diffusion, if the recovery operation is 
applied often enough; roughly, the time interval At be- 
tween error correction steps should be small compared to 
the characteristic diffusion time D^^ . 

Interactions with the environment might also damp the 
amplitude of the oscillator, as described by the master 
equation 



1 



p = T \ apa} — ^a^ap — ^pa'a 



1 



-,t. 



(79) 



here a = {q + ip)/ \f2 is the annihilation operator and F 
is a decay rate. This master equation cannot be obtained 
from a Pauli channel, but as for quantum diffusion, the 
effects of amplitude damping over short time intervals 
can be expressed in terms of small phase-space displace- 
ments. 

The master equation for amplitude damping can be 
obtained as the — > limit of the superoperator 

p{i + dt) = f (p(t)) = {^JVdt a) p(t) (Vfdi a^^ 

+ (l-i:^a^a\p{t)(l-^a^a\ . (80) 



For dt small, the annihilation operator can be expanded 
in terms of Pauli operators as 



/Tdt 



iy/rdt/2 q _ -iy/rdt/2 q') 



1 ( iy^rdt/2 p _ -iy/rdt/2 



(81) 



Thus, if the time interval At between error correction 
steps is small compared to the damping time F"""^, the 
displacements applied to codewords are small, and error 
correction will be effective. 

Aside from decoherence, we also need to worry about 
"unitary errors." For example, an inadvertent rotation 
of the phase of the oscillator induces the unitary trans- 
formation 



U{e) = exp (iea^a) 



(82) 



Like any unitary transformation, this phase rotation can 
be expanded in terms of Pauli operators. It is convenient 
to introduce the notation for the phase-space displace- 
ment operator 



Z)(7) = exp (7a — 7*0^) 

= exp (iV2 [(Im 7)9 - (Re 7)^]^ 



(83) 



where 7 is a complex number. The displacements satisfy 
the identity 



tv{D{^)D{r,)^)=wS\j-rj) , 



(84) 



so the operator U{0) can be expanded in terms of dis- 
placements as 



u{e) 



-J 



rf^7 U0{j)D{'y) 



where 



Ug{j)^tT{U{0)D{-f) 



(85) 



(86) 



Evaluating the trace in the coherent state basis, we find 
that 



we (7) 



■ exp 



2sin(6l/2) 
For small 6, the coefficient 



■ exp 



--|7|^cot((^/2) 



|7P 



(87) 



(88) 



has a rapidly oscillating phase, and can be regarded as 
a distribution with support concentrated on values of 7 
such that |7|^ 9; indeed, formally 



lim uaH) = TV S (7) . 
0^0 



(89) 



Thus a rotation by a small angle 6 can be accurately 

expanded in terms of small displacements - error correc- 
tion is effective if an oscillator is slightly overrotated or 
underrotated. 
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VIII. THE GAUSSIAN QUANTUM CHANNEL 

At what rate can error-free digital information be con- 
veyed by a noisy continuous signal? In classical informa- 
tion theory, an answer is provided by Shannon's noisy 
channel coding theorem for the Gaussian channel [ p^ . 
This theorem establishes the capacity that can be at- 
tained by a signal with specified average power, for a 
channel with specified bandwidth and specified Gaussian 
noise power. The somewhat surprising conclusion is that 
a nonzero rate can be attained for any nonvanishing value 
of the average signal power. 

A natural generalization of the Gaussian classical chan- 
nel is the Gaussian quantum channel. The Gaussian 
quantum channel is a Pauli channel: N oscillators are 
transmitted, and the q and p displacements acting on 
the oscillators are independent Gaussian random vari- 
ables with mean and variance . A code is an M- 
dimensional subspace of the Hilbert space of the N oscil- 
lators, and the rate R of the code (in qubits) is defined 



R 



N 



log2 M . 



(90) 



The quantum-information capacity Cq of the channel is 
the maximal rate at which quantum information can be 
transmitted with fidelity arbitrarily close to one. 

The need for a constraint on the signal power to define 
the capacity of the Gaussian classical channel can be un- 
derstood on dimensional grounds. The classical capacity 
(in bits) is a dimcnsionless function of the variance , 
but tJ^ has dimensions. Another quantity with the same 
dimensions as is needed to construct a dimcnsionless 
variable, and the power fulfills this role. But no power 
constraint is needed to define the quantum capacity of the 
quantum channel. The capacity (in qubits) is a function 
of the dimensionless variable ?i/ct^, where h is Planck's 
constant. 

An upper bound on the quantum capacity of the Gaus- 
sian quantum channel was derived by Holevo and Werner 
p9|; they obtained (reverting now to units with h = l) 



Cq < log2(l/a2) 



(91) 



for < cr2 < 1, and Cq = for cr^ > i They also 
computed the coherent information Iq of the Gaussian 
quantum channel, and maximized it over Gaussian signal 
states, finding fia] 



(^Q).na. = l0g2(l/e^'), 



(92) 



for < < 1/e (where e = 2.71828...). The coher- 
ent information is conjectured to be an attainable rate 
p0|-p2|; if this conjecture is true, then eq. ( p2| ) provides 
a lower bound on Cq. 

Using our continuous variable codes, rigorous lower 
bounds on Cq can be established. For cr^ sufficiently 
small, a nonzero attainable rate can be established 



asymptotically for large N by either of two methods. 
In one method, the n — 2 code described in §IV is in- 
voked for each oscillator, and concatenated with a bi- 
nary quantum code. In the other method, which more 
closely follows Shannon's construction, a code for N os- 
cillators is constructed as in § [v| , based on a close packing 
of spheres in 2A^-dimensional phase space. However (in 
contrast to the classical case), neither method works if 
cr'^ is too large. For large a^, encodings can be chosen 
that protect against q shifts or against p shifts, but not 
against both. 

To establish an attainable rate using concatenated cod- 
ing (the method that is easier to explain), we first recall a 
result concerning the quantum capacities of binary chan- 
nels |l5y23| ] . If X and Z errors are independent and each 
occur with probability pe, then binary CSS codes exist 
that achieve a rate 

R>l-2H2{pe) 

= l + 2pelog2Pe + 2(l-pe)log2(l-Pe) ; (93) 

this rate is nonzero for pe < .1100. 

Now, for the Gaussian quantum channel, if we use the 
n = 2 continuous variable code, errors afflicting the en- 
coded qubit are described by a binary channel with in- 
dependent X and Z errors. Since the code can correct 
shifts in q or p that satisfy Aq, Ap < a/tF/^, the error 
probability is 



Pe<2' 



1 



V2t^ 



dx e-^'/^.^ . 



(94) 



Since the expression bounding pe in eq. ( p^ ) has the value 
.110 for a ~ .555, we conclude that the Gaussian quan- 
tum channel has nonvanishing quantum capacity Cq pro- 
vided that 



a < .555 



(95) 



One might expect to do better by concatenating the 
hexagonal n = 2 single-oscillator code with a binary sta- 
bilizer code, since the hexagonal code can correct larger 
shifts than the code derived from a square lattice. For the 
Gaussian quantum channel, the symmetry of the hexag- 
onal lattice ensures that X,Y, and Z errors afflicting the 
encoded qubit are equally likely. A shift is correctable if 
it lies within the "Voronoi cell" of the dual lattice, the 
cell containing all the points that are closer to the origin 
than to any other lattice site. By integrating the Gaus- 
sian distribution over the hexagonal Voronoi cell, we find 
that the probability Pe, total of an uncorrectable error sat- 
isfies 



Pe, total < 1 
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rx/\/3 

dx / dy e~ 
Jq 



, (96) 



where r = (7r/2A/3)^^^ is the size of the smallest un- 
correctable shift. For a binary quantum channel with 



11 



equally likely X, Y, and Z errors, it is known that 
there are stabilizer codes achieving a nonvanishing rate 
for Pe. total < -1905; our bound on Pe, total reaches this 
value for a « .547. 

Somewhat surprisingly, for very noisy Gaussian quan- 
tum channels, square lattice codes concatenated with 
CSS codes seem to do better than hexagonal codes con- 
catenated with stabilizer codes. The reason this hap- 
pens is that a CSS code can correct independent X 
and Z errors that occur with total probability Pe. total = 
Px + Pz ~ Px ■ Pz, which approaches .2079 > .1905 as 
Px = Pz .1100. For a given value of tr, the qubit en- 
coded in each oscillator will have a lower error probability 
if the hexagonal code is used. But if the square lattice 
is used, a higher qubit error rate is permissible, and this 
effect dominates when the channel is very noisy. 

We remark that this analysis is readily extended to 
more general Gaussian quantum channels. We may con- 
sider Pauli channels acting on a single oscillator in which 
the probability distribution P{a, (3) is a more general 
Gaussian function, not necessarily symmetric in p and q. 
In that symplectic transformation (one preserving 

the commutator oip and q) can be chosen that transforms 
the covariance matrix of the Gaussian to a multiple of 
the identity; therefore, this case reduces to that already 
discussed above. We may also consider channels acting 
on N oscillators that apply shifts in the 2A^-dimensional 
phase space, chosen from a Gaussian ensemble. Again 
there is a symplectic transformation that diagonalizes the 
covariance matrix; therefore, this case reduces to N in- 
dependent single oscillator channels, each with its own 
value of (T^ [ p5[ . 

IX. SYMPLECTIC OPERATIONS 

To use these codes for fault-tolerant quantum compu- 
tation, we will need to be able to prepare encoded states, 
perform error recovery, and execute quantum gates that 
act on the encoded quantum information. The most dif- 
ficult task is encoding; we will postpone the discussion 
of encoding until after we have discussed encoded opera- 
tions and error recovery. 

Suppose, for example, that we have N oscillators, each 
encoding a qunit. We wish to apply U{n^) transforma- 
tions that preserve the code subspace of the N qunits. 
As is typical of quantum codes, we will find that there is 
a discrete subgroup of U{n^) that we can implement 
"easily;" but to complete a set of universal gates we 
must add further transformations that are "difficult." In 
the case of our continuous variable codes, the easy gates 
will be accomplished using linear optical elements (phase 
shifters and beam splitters), along with elements that can 
"squeeze" an oscillator. For the "difficult" gates we will 
require the ability to count photons. 

The easy gates are the gates in the Clifford group. In 
general, the Clifford group of a system of N qunits is the 



group of unitary transformations that, acting by conju- 
gation, take tensor products of Pauli operators to tensor 
products of Pauli operators (one says that they preserve 
the "Pauli group"). Since for N oscillators the tensor 
products of Pauli operators have the form eq. (^4|), the 
Clifford group transformations, acting by conjugation, 
are linear transformations of the p's and g's that preserve 
the canonical commutation relations. Such transforma- 
tions are called symplectic transformations. The sym- 
plectic group has a subgroup that preserves the photon 
number 

N 

total photon number = a|ai . (97) 

2 = 1 

The transformations in this subgroup can be imple- 
mented with linear optics | p6[ | . The full symplectic group 
also contains "squeeze operators" that take an a to a lin- 
ear combination of a's and a^'s; equivalently, the squeeze 
operators rescale canonical operators by a real number A 
along one axis in the quadrature plane, and by A""'^ along 
the conjugate axis, as in (for example) 

qi Xqi , pi -> A^Vi • (98) 

With squeezing and linear optics we can in principle im- 
plement any symplectic transformation. 

Aside from the symplectic transformations, we will also 
assume that it is easy to do displacements that shift q 
and p by constants. A displacement of qi by c is actually 
the limiting case of a symplectic transformation on two 
oscillators qi and q2: 

qi ^ qi+ £92 , Pi ^ Pi+ ep2 

92 ^ 92 - £91 , P2^P2- £Pi (99) 

where e — > with sq2 = c held fixed. 

Since for the code with stabilizer generators eq. ( |2l| ) 
the Pauli operators acting on our encoded qunits are 
X = e'P" and Z = e^'^"^/"", the Clifford group trans- 
formations acting on N qunits constitute a subgroup of 
the symplectic transformations (including shifts) acting 
on TV oscillators, the subgroup that preserves a specified 
lattice in phase space. Thus we can do any encoded Clif- 
ford group gate we please by executing an appropriate 
symplectic transformation (possibly including a shift). 

A similar comment applies to the case of a qunit en- 
coded in a qudit. Since the logical Pauli operators are 
X = X^^ and Z = Z''^ , each Clifford group transforma- 
tion in the n-dimensional code space is also a Clifford 
group transformation on the underlying qudit. 

But we must also be sure that our implementation of 
the Clifford group is fault tolerant In previous discus- 
sions of quantum fault tolerance for [[TV, fc, 2t + 1]] codes, 
the central theme has been that propagation of error from 
one qudit to another in the same code block must be very 
carefully controlled [^,|8j. For shift-resistant codes the 
main issue is rather different. Since each qudit typically 
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has a (small) error anyway, propagation of error from one 
qudit to another is not necessarily so serious. But what 
must be controlled is amplification of errors - gates that 
turn small errors into large errors should be avoided. 

The Clifford group can be generated by gates that are 
fault-tolerant in this sense. The Clifford group for qunits 
can be generated by three elements. The SUM gate is 
a two-qunit gate that acts by conjugation on the Pauli 
operators according to 



SUM 



ziz, 



(100) 



Here qunit 1 is said to be the control of the SUM gate, 
and qunit 2 is said to be its target; in the binary (n = 2) 
case, SUM is known as controUed-NOT, or CNOT. The 
Fourier gate F acts by conjugation as 



F 



X 



z X- 



(101) 



for n = 2 the Fourier Transform is called the Hadamard 
gate. The phase gate P acts as 



P : X ^ iv)XZ , 



Z 



(102) 



where the n-dependent phase is uj^^^ if n is even and 
1 if n is odd. Any element of the Clifford group can 
be expressed as a product of these three generators. (In 
Ref. Q another gate S was included among the genera- 
tors of the Clifford group, but in fact the 5* gate can be 
expressed as a product of SUM gates.) 

For an n-dimensional system encoded in a continuous 
variable system, these Clifford group generators can all 
be realized as symplectic transformations. In the case 
where the stabilizer generators are symmetric in q and p, 



X 



exp 




exp I iq\l— ) , (103) 



of the oscillator. For example, suppose that we measure 
q for a state in the code subspace. If there are no errors 
and the measurement has perfect resolution, the only al- 
lowed values of q will be integer multiples of a. If there 
are errors or the measurement is imperfect, classical error 
correction can be applied to the outcome, by adjusting 
it to the nearest a ■ k, where k is an integer. Then the 
outcome of the measurement oi Z \s uj^ . 

To diagnose errors in a coded data state, we must mea- 
sure the stabilizer generators. This measurement can be 
implemented by "feeding" the errors from the code block 
to a coded ancilla, and then measuring the ancilla de- 
structively, following the general procedure proposed by 
Steane (see Fig. For example, to measure the 
generator e^'^*''/" (i.e., the value of q modulo a), we pre- 
pare the ancilla in the state (|0) -I- |l))/\/2, the equally 
weighted superposition of all \q — s ■ a), s an integer. 
Then a SUM gate is executed with the data as control 
and the ancilla as target - acting according to 



(72 ~> <7i + 92 , 



(105) 



where qi , q^ are the values of q for the data and ancilla 
respectively, prior to the execution of the SUM gate. By 
measuring q of the ancilla, the value of qi+q2 is obtained, 
and this value modulo a determines the shift that should 
be applied to the data to recover from the error. 

Similarly, to measure the stabilizer generator e™^" , we 
prepare the ancilla in the state |0), the equally weighted 
superposition of all \p = s ■ 27r/na), s an integer. Then a 
SUM gate is executed with the ancilla as control and the 
data as target. Finally, the p quadrature of the ancilla 
is measured. The outcome reveals the value of p2 — Pi 
prior to the SUM gate, where pi is the momentum of 
the data, and p2 is the momentum of the ancilla. The 
measured value modulo It: jna then determines the shift 
that should be applied to the data to recover from the 
error. 



the required symplectic transformations are 



SUM 

F : 
P : 



91 

92 

9 - 
9 - 



91 , 
-^91+92 
V , 
9 , 



pi ~> pi - 

P2^P2 , 

p^p-q 



P2 



(104) 



where the n-dependent shift c is for n even and •y/7r72n 
for n odd. Under these symplectic transformations, small 
deviations of q and p from the stabilizer lattice remain 
small; in this sense the transformations are fault tolerant. 



X. ERROR RECOVERY 

If we are willing to destroy the encoded state, then 
measuring the encoded X or Z is easy - we simply con- 
duct a homodyne measurement of the q or p quadrature 



(a) 



data 



\X = 1) 



data 



1) 



SUM Measure q 



SUM 



■ Measure p 



FIG. 4. Measurement of the error syndrome, (a) To diag- 
nose the q shift, an ancilla is prepared in the encoded X = 1 
state, a SUM gate is executed with the data as control and 
the ancilla as target, and the position of the ancilla is mea- 
sured. (6) To diagnose the p shift, the ancilla is prepared in 
the Z = 1 state, a SUM gate is executed with the ancilla 
as control and the data as target, and the momentum of the 
ancilla is measured. 
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Of course, the ancilla used in the syndrome measure- 
ment can also be faulty, resulting in errors in the syn- 
drome and imperfect recovery. Similarly, the measure- 
ment itself will not have perfect resolution, and the shift 
applied to recover will not be precisely correct. Fur- 
thermore, as is discussed in §0 the ideal codewords are 
unphysical nonnormalizable states, so that the encoded 
information will always be carried by approximate code- 
words. For all these reasons, deviations from the code 
subspace are unavoidable. But if a fresh supply of ancilla 
oscillators is continuously available, we can prevent these 
small errors from accumulating and eventually damaging 
the encoded quantum information. 



XI. UNIVERSAL QUANTUM COMPUTATION 

Symplectic transformations together with homodyne 
measurements are adequate for Clifford group computa- 
tion and for error recovery (assuming we have a supply 
of encoded states). But to achieve universal computa- 
tion in the code space, we need to introduce additional 
operations. Fortunately, the quantum optics laboratory 
offers us another tool that can be used to go beyond the 
symplectic computational model - the ability to count 
photons. 

There are a variety of ways in which photon count- 
ing can be exploited to complete a universal set of fault- 
tolerant gates. We will describe two possible ways, just 
to illustrate how universal fault-tolerant quantum com- 
putation might be realized with plausible experimental 
tools. For this discussion, we will consider the binary 
case n = 2. 



A. Preparing a Hadamard eigenstate 

We can complete the universal gate set if we have the 
ability to prepare eigenstates of the Hadamard operator 
H [^,^. For this purpose it suffices to be able to de- 
structively measure H of an encoded qubit. Assuming we 
are able to prepare a supply of the encoded Z eigenstate 
|0), we can make an encoded EPR pair using symplectic 
gates. Then by destructively measuring H for one en- 
coded qubit in the pair, we prepare the other qubit in an 
encoded eigenstate of H with known eigenvalue. 

But how can we destructively measure H? The 
Hadamard gate acts by conjugation on the encoded Pauli 
operators according to 



H : X 



Z , Z ^ X . 



(106) 



If we use the code that treats q and p symmetrically so 
that X = exp(— ?p-y/7r) and Z = exp(i(7-y/7r), then the 
Hadamard gate can be implemented by the symplectic 
transformation. 



(recalling that = Z"^ = I on the code subspace). This 
transformation is just the Fourier transform 



F : 



exp 



(108) 



(where a^a is the photon number), which describes the 
natural evolution of the oscillator for one quarter cycle. 
Thus the phase of the Hadamard operator is simply the 
photon number modulo four; we can measure the eigen- 
value of the encoded Hadamard transformation by count- 
ing photons. 

In fact the photon number in the code space is even - 
all codewords are invariant under a 180° rotation in the 
quadrature plane. Because of this feature, the prepara- 
tion of the Hadamard eigenstate has some fault tolerance 
built in; if the photon count is off by one, the number will 
be odd and an error will be detected. In that case we re- 
ject the state we have prepared and make a new attempt. 
If the photon number is large, then obtaining a reliable 
determination of the photon number modulo four will re- 
quire highly efficient photodetection. But on the other 
hand, the photon number need not be very large - the 
mean value of a^a is about where A is the squeeze 
factor, and we have seen that the intrinsic error rate due 
to imperfect squeezing is quite small for A ~ 1/4, or 
(flta) ~ 16. 

An alternative to preparing an encoded EPR pair and 
destructively measuring one member of the pair is to pre- 
pare |0) and then perform a quantum nondemolition mea- 
surement of the photon number modulo 4. This might 
be done by coupling the oscillator to a two-level atom 
as proposed in Ref. |^^. Indeed, since only one bit of 
information needs to be collected (the photon number 
is either or 2 modulo 4), the measurement could be 
made in principle by reading out a single atom. Suppose 
that the coupling of oscillator to atom is described by the 
perturbation 



H' ^ X a) a az 



(109) 



where cr^ = — 1 in the atomic ground state \g) and Uz = 
1 in the atomic excited state |e). By turning on this 
coupling for a time t = 7r/4A, we execute the unitary 
transformation 

U = exp(-i(7r/4) a) a cr^) . (110) 

Then the atomic state (|g) + \e))/\/2 evolves as 



U: ^{\9) + \e)) 
v2 



(111) 



(107) 



By measuring the atomic state in the basis ( | g) ± | e) ) / ^2, 
we read out the value of the photon number modulo 4 
(assumed to be either 2 or 4). Since this is a nondemoli- 
tion measurement, it can be repeated to improve reliabil- 
ity. By measuring the photon number mod 4 many times 
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(perhaps with rounds of error correction in between the 
measurements), we obtain a Hadamard eigenstate with 
excellent fidehty. 

How does the abihty to construct the Hadamard eigen- 
state enable us to achieve universal quantum computa- 
tion? We can make contact with constructions that have 
been described previously in the literature by observing 
that the Hadamard eigenstate can be transformed by ap- 
plying symplectic gates to the "tt/S phase state." First 
note that the two Hadamard eigenstates can be converted 
to one another by applying the encoded gate XZ ^ which 
can be implemented by shifting both p and q. Therefore 
it is sufficient to consider the eigenstate corresponding to 
the eigenvalue 1, 



(112) 



H P- 



1 1 

1 -1 



1 

-i 



(113) 



\4'H=i) = cos(^/8) |0) + sin(^/8) |1) . 
By applying the symplectic single-qubit gate 
1 

we obtain the 7r/8 state 

iV'./s) = ^(e— /«|0)-fe-/8|l)) . (114) 

Now this tt/B state can be used to perform the non- 
symplectic phase gate 



e'""/^ 



(115) 



which completes the universal gate set 34 . The gate 
is constructed by executing the circuit shown in Fig. |^. 
We perform a CNOT gate with the arbitrary single-qubit 
state It/i) = a|0) -|- 6|1) as the control, and the 7r/8 phase 
state as the target; then the target qubit is measured 
in the basis {|0),|1)}. If the measurement outcome is 
|0) (which occurs with probability 1/2), then the control 
qubit has become ae*''/®|0) + 6e"'''/^|l) = S\ii)) and we 
are done. If the measurement outcome is |1), then the 
control qubit has become ae~*'^/^|0) -I- &e*'^/*|l), and we 
obtain S\'ip) by applying the symplectic single-qubit gate 



g-i7r/4 









(116) 



IV'tt/s) 



P — S\^) 



Measure 



FIG. 5. Implementation of the S gate. An ancilla is pre- 
pared in the state li/^^/g), and a CNOT gate is executed with 
the data as control and the ancilla as target; then the ancilla 
is measured in the basis {|0), A P gate is applied to the 

data conditioned on the measurement outcome. 



Completing the universal gate set by measuring the 
Hadamard transformation has some drawbacks. For one 
thing, while photon number modulo four corresponds to 
the Hadamard eigenvalue in the ideal code space, this 
correspondence will not apply to approximate codewords 
unless they are of a special type. 

Recall that the imperfections of the codewords arising 
from finite squeezing can be described by an "embedded 
error" |ry) as in eq. (^0|); a Gaussian approximate code- 
word has a Gaussian embedded error 



ri{u,v) 



1 



VttAk 



exp 



(-i(.VA^ + -V-^) 



(117) 



where A is the width in q and n is the width in p. Sym- 
plectic gates act separately on the encoded qubit and the 
"embedded error" |?7); for example, the Fourier transform 
gate and the SUM gate act on the error according to 

F : \u,v) \v, -u) , 

SUM : \ui,vi;u2, V2) vi + V2] U2 - ui, V2) ■ (118) 

By measuring the photon number modulo 4, we actually 
measure the product of the eigenvalue of the Hadamard 
gate acting on the codeword and the eigenvalue of F act- 
ing on the embedded error. The latter always equals 1 if 
we use symmetrically squeezed codewords, with A = n. 

Symmetric squeezing is not in itself sufficient to ensure 
that the measurement of the photon number modulo 4 
will prepare the desired encoded Hadamard eigenstate. 
We also need to consider how the embedded error is af- 
fected by the preparation of the EPR pair that precedes 
the measurement. To prepare the EPR pair, we use the 
SUM gate. Suppose that we start with two symmet- 
rically squeezed states. Then the SUM gate yields the 
error wave function 



ri'{ui,vi;u2,V2) 
= exp (- (uj + {vi 



V2)' + {U,+U2f+Vi)/A') . (119) 



Not only is it not symmetric, but the error is entangled 
between the two oscillators. The Fourier transform mea- 
surement will not give the desired result when applied to 
either oscillator. 

To ameliorate this problem, we could perform error 
correction after the preparation of the EPR pair and be- 
fore the measurement, where the error correction proto- 
col has been designed to produce symmetrically squeezed 
states. Or we could avoid preparing the EPR state by 
using the nondemolition measurement of photon number 
modulo 4, as described above. 



B. Preparing a cubic phase state 

Now we will describe another way to use photon count- 
ing to implement non-symplectic gates, which is less sen- 
sitive to the codeword quality. Again, we will complete 
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the universal gate set by constructing the 7r/8 phase gate 
S. 

For our binary (n — 2) code, the code subspace has 
the basis 



+00 



|0) ^ \l = , 

S — — OC 

-\-OQ 

|i) = k = (2s + i)"> 



(120) 



s— — 00 



(For now we ignore the embedded error due to imperfect 
squeezing; it will be taken into account later.) An S gate 
acting on the encoded qubit is implemented (up to an 
irrelevant overall phase) by the unitary operator 



= exp ( - [2(g/a)3 + {q/af - 2(g/a)] ) . (121) 



Indeed, we can check that 



2x^ +x^-2x (mod 8) ^ <! ?' 'I'^^l^ \ , (122) 
^ ' ' 1, II a; = 2s + 1 ^ ' 



The operator W is the product of a symplectic gate 
and the cubic phase gate 



(123) 



where 7 = 7r/(2a^). But how do we implement the cubic 
gate? In fact, if we are able to prepare a "cubic phase 

state" 



|7)= / dxe^''^ \x) , 



(124) 



then we can perform the gate V-y by executing the circuit 
shown in Fig. ||. 



l7) 



U{a) 



SUM-i 



Measure q 



FIG. 6. Implementation of the cubic phase gate. An ancilla 
is prepared in the state I7), and a SUM~^ gate is executed 
with the data as control and the ancilla as target; then the 
position of the ancilla is measured. A symplectic gate U{a) 
is then applied to the data, conditioned on the outcome a of 
the measurement. 

To understand how the circuit works, consider the 
more general problem of implementing a phase gate that 
acts on the position eigenstates according to 



: \q) 



i<t>{q) 



(125) 



(where 4>{q) is a real- valued function), using the prepared 
phase state 



(126) 



If we perform the gate SUM^^ with position eigenstate 
\q) as control and \<j)) as target, and then measure the 
position of the target obtaining the outcome |a), the state 
of the control oscillator has become e^^'-'^^"^ jg). We can 
therefore complete the construction of by applying the 
transformation 



U(a) 



(127) 



If the function (j){q) is cubic, then the argument of the 
exponential is quadratic and hence U{a) is a symplectic 
transformation. 

Now the problem of implementing universal quantum 
computation in the code subspace has been reduced to 
the problem of preparing the cubic phase state I7). We 
can accomplish this task by preparing an EPR pair, and 
then performing a suitable photon counting measurement 
(a nonideal homodyne measurement) on one member of 
the pair. 

Of course, the EPR pair will not be perfect. To be 
definite, let us suppose (although this assumption is not 
really necessary) that it is a Gaussian state 



IV'(Tp,cr,) 



1/2 



dqidq2 exp 



1 2/91+92 



X exp 



{qi -92) /crl 



m,q2) 



(128) 



with <7p,aq ^ 1. 

Now suppose that the second oscillator is mixed with 
a coherent light beam, resulting in a large shift in mo- 
mentum, 



1^) 



w:$> ag^,ap'^ 



(129) 



then the photon number is measured and n photons are 
detected. Thus the state of the first oscillator becomes 
(up to normalization) 



(»)\ 



cr. 



P 



TTCTo 



1/2 



dqi \qi)e 
X / dg2^;(g2)e™«=e- 



p9i 



^(9l-<22)V^^ 



(130) 



where \(pn) denotes the photon number eigenstate, the 
eigenstate with eigenvalue 71 -I- i of the Hamiltonian H = 



We can evaluate the q2 integral in eq. (130) by ap- 
pealing to the semiclassical approximation. For q2 in the 
classically allowed region and far from the classical turn- 
ing points, we may write 



1 



V27rp(q2) 
_^ 1 

V27rp(92) 



exp 



92 



exp 



dxp{x) 



dxp{x) 



(131) 
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where 



(132) 



For w 3> c^q^, the rapid phase osciUations strongly sup- 
press the contribution to the integral arising from the 
left-moving part of t/?*-"^ ((72)- A contribution from the 
right-moving part survives provided that 



w\ < a„ 



(133) 



When this condition is satisfied, it is a reasonable approx- 
imation to replace the Gaussian factor e 2W1 92 j /o-, -^^ 
the q2 integral by ^ 2iTa'^ 5{qi — 52), so that we obtain 



1 



exp { ~i dx {p{x) — w) ] . (134) 



\/27rp(gi) 



The probability that n photons are detected is given by 
the norm of this IV'i"'')- The value s of n that occur with 
appreciable probability satisfy eq. (|133[) for some qi with 



\qi\ < <Jp^; thus typical measurement outcomes are in 
the range 



1 1 



1 



with a flat probability distribution 
Prob(n) = (V'^"^!"-') ~ 



w 



(135) 



(136) 



Heuristically, after the momentum shift is applied, the 
oscillator that is measured has momentum of order w ± 
cr~^, and position of order cr~^, so that the value of the 

energy is n + ^ = i(p2 + q'^) ^ [w ± a-'^f + ^ct^ ^ 

For a particular typical outcome of the photon- 
counting measurement, since IV"!™^) has its support on 
\qi\ < ^ w, we can Taylor expand p(a;) about x — qi 

to express {ipi^^) as 

4"^(,r)ocexp(_./"(y(2;^TTF^-.)d.) 



oc exp 



= qf - i{y/2n + 1 - w)qi 



+0{qVw' 



(137) 



This is a cubic phase state to good precision if w is large 
enough. 

The coefficient 7' of qf in the phase of ipi is of order 
n~^/^, while the phase 7 of the operator Vy that we wish 
to execute is of order one. However, we can construct V-y 
from V-y' as 



where Sr is a squeeze operation that acts according to 
Sr-.q^ (r)i/3. 



9 
P 



(r)-i/3 



P 



(139) 



Alternatively, we could squeeze the phase state I7') before 
we use it to implement the cubic phase gate. 

Is this procedure fault tolerant? Before considering the 
errors introduced during the implementation of the cubic 
phase gate, we should check that the gate does not catas- 
trophically amplify any preexisting errors. In general, a 
phase gate can transform a small position shift error into 
a potentially dangerous momentum shift error. Com- 
muting V^((/)) = e*'^^''^ through the shift operator e^'"'P, 
we find 



gi0(9)g-™P — g-™Pg*/i»(9)g#('3) 



(140) 



where fuil) — 4'i<l + u) — (j}{q); the operator e*-^"^''^ can be 
expanded in terms of momentum shift operators of the 
form e'"^ by evaluating the Fourier transform 



dq 
— f 
27r 



(141) 



Assuming we use a code where the parameter a is of 
order one, uncorrectable errors will be likely if /u(w) has 
significant support on values of v that are order one. 

Suppose that V{(j)) acts on an approximate codeword 
whose wave function is concentrated on values of q in 
the domain \q\ < L. Phase cancellations will strongly 
suppress fu(v), unless the stationary phase condition 
fu (9) ^ V is satisfied for some value of q in the domain of 
the approximate codeword. Therefore, V{(j)) can propa- 
gate a preexisting position shift u to a momentum shift 
error of magnitude 



max \fl{q)\ 

\<l\<L 



(142) 



The cubic phase gate needed to implement the encoded 
S gate is W = e*"^(«) where (j}{q) = Trq^/2a^, so that 
fu{q) — inuq^ /2a^ + • • • (ignoring small terms linear and 
constant in q), and f'^(q) = Siruq/a^; the gate transforms 
the position shift it to a momentum shift 



(143) 



For a of order one, then, to ensure that v is small we 
should use approximate codewords with the property 
that the typical embedded position shift u satisfies 



(144) 



In particular, if the approximate codeword's embedded 
errors are Gaussian, where k is the typical size of a mo- 
mentum shift and A is the typical size of a position shift, 
we require 
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A < AC 



(145) 



C. Purification 



We assume that shift errors due to other causes are no 
larger than the embedded error. 

In the circuit Fig. ^ that implements the cubic phase 
gate, position shift errors in either the encoded state IV') 
or the ancilla state I7) might cause trouble. A shift by 
u in \^p) is transformed to a phase error e^f"^'^\ and a 
shift by u in I7) infects \^) with a phase error e*-''" 
Therefore, we should require that position shift errors in 
both \ip) and I7) satisfy the criterion eq. (144), where L 
is the larger of the two wave packet widths. 

When a cubic phase state is prepared by measuring 
half of an EPR pair, the packet width is of order cr~^ 
and typical position shift errors have u ~ cTg. However, 
we must also take into account that either the encoded 



state or the ancilla must be squeezed as in eq. (139). 



Suppose that the ancilla is squeezed, by a factor of order 
^1/6 ^ the wave packet is rescaled so that, after 

squeezing, the width L' and the typical shifts u' are given 
by 



L' 



w 



-1/3 



-1/3 



(146) 



Then the condition \u'\ ^ L' ^ is satisfied provided that 
<Jq <C (TpUp'^^. We also require that the rescaled packet 
has width large compared to 1, or cTp <C w~^^^ . 

For the derivation of eq. (137), we used the approxima- 



tions waq » 1 and wap ^ 1. We also need to check that 
the remainder terms in the Taylor expansion give rise to 
a phase error that is acceptably small. This error has the 
form e*-'"'''!), where f{qi) = 0{qi/w^), corresponding to 
a momentum shift 



fin) 



(147) 



Squeezing amplifies this momentum shift error to v' ^ 
vw^^^ ^ Gp^w^^^^^ which will be small compared to 
1 provided that Op S> w~'^^^. To summarize, our im- 
plementation of the cubic phase gate works well if the 
approximate codewords have embedded errors satisfying 
A <C K, and if widths aq and <Tp of the approximate EPR 
state satisfy w S> (t7^ and 



> w 



-2/3 



(148) 



Finally, how accurately must we count the photons? 
An error An in the photon number results in a phase 
error e™^^ with |^;| ~ n~"'^/^An in '>p'^^\qi), which will 
be amplified by squeezing to |t;'| ~ |t;|u;^/^ ^ n~^/^An. 
Therefore, the precision of the photon number measure- 
ment should satisfy 



An < n^/^ 

to ensure that this error is acceptably small. 



(149) 



Either of the above two methods could be used to im- 
plement a nonsymplectic phase transformation that com- 
pletes the universal gate set. Of course, experimental 
limitations might make it challenging to execute the gate 
with very high fidelity. One wonders whether it is pos- 
sible to refine the method to implement fault-tolerant 
universal gates of improved fidelity. 

In fact, such refinements are possible. We have seen 
that we can reach beyond the symplectic transformations 
and achieve universal quantum computation if we have a 
supply of appropriate "nonsymplectic states" that can't 
be created with the symplectic gates. If the nonsymplec- 
tic states have the right properties, then we can carry 
out a purification protocol to distill from our initial sup- 
ply of noisy nonsymplectic states a smaller number of 
nonsymplectic states with much better fidelity ]3^ , |3^ . 

An example of a nonsymplectic state that admits such 
a purification protocol is a variant of the state originally 
introduced by Shor [E^ , the three-qubit state 



2-3/2 ^ {^.l)a,c^a),mc), ■ 
a.b,ce{OS} 



(150) 



it can be characterized as the simultaneous eigenstate of 
three commuting symplectic operators: A(Z)i_2^3 and 
its two cyclic permutations, where A(Z) is the two-qubit 
conditional phase gate 



A(Z):|a,6)^(-l)'^V,6) 



(151) 



As Shor explained, this nonsymplectic state can be em- 
ployed to implement the Toffoli gate 



|a, 6, c ah) 



(152) 



and so provides an alternative way to complete the uni- 
versal gate set. 

To purify our supply of nonsymplectic states, symplec- 
tic gates are applied to a pair of nonsymplectic states and 
then one of the states is measured. Based on the outcome 
of the measurement, the other state is either kept or dis- 
carded. If the initial ensemble of states approximates the 
nonsymplectic states with adequate fidelity, then as pu- 
rification proceeds, the fidelity of the remaining ensemble 
converges rapidly toward one. 

The details of the purification protocol will be de- 
scribed elsewhere; here we will only remark that these 
Shor states can be readily created using symplectic gates 
and 7r/8 phase gates. The Shor state is obtained if we 
apply the transformation 



K\Z):\a,b,c)^{-lT''\aAc) 



(153) 



to the state 



i/iff2i?3|0, 0,0) = 2-3/2 \a,b,c) . (154) 

a,6,cg{0,l} 
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As shown in Fig. ^, A^(Z) can be applied by executing a 
circuit containing 5 S gates, 4 gates, and 8 CNOT 
gates. 
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FIG. 7. Construction of the three-qubit gate A^{Z). (a) A 
A(P) gate can be constructed (up to an overall phase) from 
two 5* gates, an gate, and two CNOT's. The circuit is exe- 
cuted from left to right, (b) A A'^{Z) gates can be constructed 
from two A(P) gates, a A(P"^) gate, and two CNOT's. 

Therefore, if we can apply symplectic gates accurately, 
and are also able to create a supply of 7r/8 states of rea- 
sonable fidelity (or can otherwise implement 5* gates of 
reasonable fidelity), then we can use the purification pro- 
tocol to implement TofFoli gates with very good fidelity. 



XII. ENCODING 

Now we have discussed how to execute universal quan- 
tum computation fault tolerantly, and how to perform 
error recovery. But the discussion has all been premised 
on the assumption that we can prepare encoded states. 
It is finally time to consider how this can be done. In 
fact, preparing simultaneous eigenstates of the stabilizer 
generators exp{2Triq/a) and exp(— inpa) is a challenging 
task. 

For the [[N, k]] stabilizer codes that have been dis- 
cussed previously, encoding is not intrinsically difficult 
in that it can be accomplished with Clifford group gates. 
Acting by conjugation, Clifford group transformations 
take tensor products of Pauli matrices to tensor products 
of Pauli operators. In particular, there is a Clifford group 
transformation that takes the state |0)®^ (the simultane- 
ous eigenstate with eigenvalue one of all N single-qubit 
Z's) to the encoded jO)®*^ (the simultaneous eigenstate 
with eigenvalue one of (N — k) stabilizer generators and 
k encoded Z's). 

Where our codes are different, in both their finite- 
dimensional and infinite-dimensional incarnations, is 
that a single qudit or oscillator is required to obey two in- 
dependent stabilizer conditions - i.e., to be the simultane- 
ous eigenstate of two independent Pauli operators. Hence 
there is no Clifford group encoder. In the continuous 
variable case, the problem can be stated in more familiar 
language: the symplectic transformations take Gaussian 



(coherent or squeezed) states to Gaussian states. Hence 
no symplectic transformation can take (say) the oscilla- 
tor's ground state to a state in the code subspace. 

So encoding requires nonsymplectic operations, and as 
far as we know it cannot be accomplished by counting 
photons either - we must resort to a nonlinear coupling 
between oscillators, such as a x'"^^ coupling. We will de- 
scribe one possible encoding scheme: First, we prepare 
a squeezed state, an eigenstate of the momentum with 
p — 0. This state is already an eigenstate with eigen- 
value one of the stabilizer generator e™''", but not an 
eigenstate of e^'^*''/"; rather its value of q is completely 
indefinite. To obtain an encoded state, we must project 
out the component with a definite value of q modulo a. 

This can be achieved by coupling the oscillator to an- 
other oscillator that serves as a meter, via the perturba- 
tion of the Hamiltonian 



H' = Xq (b^b) 



(155) 



where b is the annihilation operator of the meter |^ This 
perturbation modifies the frequency of the meter. 



(156) 



then if this coupling is turned on for a time t — 2t: /Xna, 
the phase of the meter advances by 



2'Kq/na 



(157) 



By reading out the phase, we can determine the value of 
q modulo na, and apply a shift if necessary to obtain the 
state with q = (mod na), the known state \Q) in the 
code subspace. (See Fig. |[) 



{a) 




FIG. 8. Preparation of an encoded state, (a) An eigenstate 
of p is prepared, which has an indefinite value of q. (b) The 
value of q modulo na is measured, projecting out a state that 
differs from the encoded Z eigenstate by a shift in q. 



^ There is an extensive literature on the experimental real- 
ization and applications of this kind of coupling; see |p7[. 
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Of course, in practice the state squeezed in p prepared 
in the first step wiU be only finitely squeezed, and the 
measurement of q modulo na will have imperfect resolu- 
tion. If the squeezed state is Gaussian and the measure- 
ment has a Gaussian acceptance, then this procedure will 
produce an approximate codeword of the sort described 
in§0 

If we are able to prepare "good enough" encoded 
states, we can distill better ones. The distillation proto- 
col is similar to the error recovery procedure, but where 
the ancilla used for syndrome measurement may be fairly 
noisy. We might improve the convergence of the distil- 
lation procedure by discarding the data oscillator if the 
measurement of the ancilla oscillator yields a value of q 
or p that is too distant from the values allowed by the 
code stabilizer. 

So far, we have described how to prepare encoded 
states for the "single-oscillator" codes described in i ^V| . 
To prepare an encoded state for one of the TV-oscillator 
codes described in §VI, we proceed in two steps. First 



S = Mf^Ms 



(162) 



we prepare each of N oscillators in a single-oscillator en- 
coded state. Then we apply a symplectic transformation 
to obtain the encoded state of the A^-oscillator code. 

A particular known encoded state of a lattice stabilizer 
code can itself be regarded as a code with an (n = 1)- 
dimensional code space. Hence it can be characterized 
by a self-dual symplectic lattice. For example, the X — 1 
state of a qunit encoded in a single oscillator is the simul- 
taneous eigenstate with eigenvalue one of the operators 
g-ipQ g^j^^ g27ri(j/Q _ ^YiQ state associated with the self-dual 
lattice whose basis vectors are paj^phi and q\f^ ja. 

One encoded state can be transformed to another by 
symplectic gates if there is a symplectic linear transfor- 
mation that takes the self-dual lattice associated with the 
first state to the self-dual lattice associated with the sec- 
ond. In fact, such a symplectic transformation exists for 
any pair of self-dual lattices. 

A linear transformation acting on the p's and q's mod- 
ifies the generator matrix M of a lattice according to 



M -> M5 ; 
this transformation is symplectic if 
SujS^ — uj , 

where 



/ 

-/ 



(158) 
(159) 

(160) 



We saw in §VI that we can always choose the generator 
matrix M of a self-dual lattice so that the matrix A has 
the form 



(161) 



that is, so that M is a symplectic matrix. Therefore, 
the generator matrices Mi and M2 of two self-dual lat- 
tices can each be chosen to be symplectic; then the linear 
transformation 



that takes one lattice to the other is also symplectic. 

Thus, while the task of preparing the encoded states 
of the single-oscillator codes can be accomplished only 
by introducing a nonlinear coupling between oscillators, 
proceeding from single-oscillator encoded states to many- 
oscillator encoded states can be achieved with linear op- 
tical operations and squeezing. 



XIII. PHYSICAL FAULT TOLERANCE? 

In a physical setting, making use of the continuous 
variable quantum error-correcting codes proposed here 
(or "digital" quantum codes that have been proposed 
previously) is a daunting challenge. We must continually 
measure the stabilizer operators (the "error syndrome") 
to diagnose the errors; to recover we must apply frequent 
shifts of the canonical variables that are conditioned on 
the measurement outcomes. Cold ancilla oscillators must 
be provided that are steadily consumed by the syndrome 
measurements. The ancillas must be discarded (or re- 
freshed) to rid the system of excess entropy that has been 
introduced by the accumulated errors. 

An alternative to this complex scheme was suggested 
in Ref. ||3^ . Perhaps we can engineer a quantum system 
whose (degenerate) ground state is the code subspace. 
Then the natural coupling of the system to its environ- 
ment will allow the system to relax to the code space, re- 
moving errors introduced by quantum and thermal noise, 
or through the imperfect execution of quantum gates. 
Such a system, if it could be built, would be a highly 
stable quantum memory. 

Gontinuous variable coding suggests new approaches to 
implementing this type of physical fault tolerance. For 
example, the Hamiltonian 



H = 2 — [cosp + cos(27rnq)] 



(163) 



has an n-fold degenerate (but nonnormalizable) ground 
state that is just the code space of a continuous vari- 
able code. (The operators cosp and cos27rng commute 
and can be simultaneously diagonalized.) The low-lying 
states of a real system whose Hamiltonian is a reason- 
able approximation to H would resemble the approxi- 
mate codewords described in 

One possible way to realize physical fault tolerance is 
suggested by the codes for an electron in a Landau level, 
described in 



III 



The wave functions in the code space 
are doubly periodic with a unit cell that encloses n flux 
quanta, where n is the code's dimension. If we turn on a 
tunable periodic potential whose unit cell matches that 
of the code, then the Landau level is split into n energy 
bands, and the codewords are the states with vanishing 
Bloch momentum. Therefore, an encoded state could be 
prepared by turning on the potential, waiting for dissipa- 
tive effects to cause the electrons to relax to the bottom 
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of the lowest band, and then adiabatically turning off the 
potential. If dissipative effects cause electrons to relax to 
the bottom of a band on a time scale that is short com- 
pared to spontaneous decay from one band to another, 
then more general encoded states could be prepared by 
a similar method. Furthermore, turning on the potential 
from time to time would remove the accumulated Bloch 
momentum introduced by errors, allowing the electron to 
relax back to the code space. 



tum codes can be invoked to investigate the efficacy of 
quantum cryptographic protocols, even in cases where 
the protocol makes no direct use of the encoded states 
p9| . With continuous variable codes, we can demon- 
strate the security of key distribution protocols based on 
the transmission of continuous variable quantum infor- 
mation. This application is discussed in a separate paper 




XIV. CONCLUDING COMMENTS 

We have described codes that protect quantum states 
encoded in a finite-dimensional subspace of the Hilbert 
space of a system described by continuous quantum vari- 
ables. With these codes, continuous variable systems can 
be used for robust storage and fault-tolerant processing 
of quantum information. 

For example, the coded information could reside in 
the Hilbert space of a single-particle system described 
by canonical quantum variables q and p. In practice, 
these variables might describe the states of a mode of 
the electromagnetic field in a high-finesse microcavity, or 
the state of the center of mass motion of an ion in a 
trap. Or the continuous Hilbert space could be the state 
space of a rotor described by an angular variable 9 and 
its conjugate angular momentum L; in practice, these 
variables might be the phase and charge of a supercon- 
ducting quantum dot. Our coding scheme can also be 
applied to a charged particle in a magnetic field. 

Our codes are designed to protect against small errors 
that occur continually - diffusive drifts in the values of 
the canonical variables. The codes are less effective in 
protecting against large errors that occur rarely. In some 
settings, we may desire protection against both kinds of 
errors. One way to achieve that would be to concatenate 
our continuous-variable codes with conventional finite- 
dimensional quantum codes. 

When we consider how to manipulate continuous- 
variable quantum information fault tolerantly, the issues 
that arise are rather different than in previous discussions 
of quantum fault tolerance. With continuous variable 
codes, propagation of error from one oscillator to another 
is not necessarily a serious problem. More damaging are 
processes that amplify a small shift of the canonical vari- 
ables to a large shift. We have described how to im- 
plement a universal set of fault-tolerant quantum gates; 
with these, harmful error amplification can be avoided as 
the encoded state is processed. 

Apart from encouraging the intriguing possibility that 
continuous quantum variables might prove useful for the 
construction of robust quantum memories and comput- 
ers, these new quantum codes also have important the- 
oretical applications. In this paper we have discussed 
an application to the theory of the quantum capacity 
of the Gaussian quantum channel. Furthermore, quan- 
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